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Abstract 

Hoare logic is a foundation of axiomatic semantics of classical programs and 
it provides effective proof techniques for reasoning about correctness of classical 
programs. To offer similar techniques for quantum program verification and to 
build a logical foundation of programming methodology for quantum computers, 
we develop a full-fledged Hoare logic for both partial and total correctness of 
quantum programs. It is proved that this logic is (relatively) complete by 
exploiting the power of weakest preconditions and weakest liberal preconditions 
for quantum programs. 

Keywords: Quantum computation, programming language, axiomatic se- 
mantics, Hoare logic, completeness 



1 Introduction 

Even though quantum hardware is still in its infancy, people widely beheve that 
building a large-scale and functional quantum computer is merely a matter of time 
and concentrated effort. The history of classical computing arouses that once quan- 
tum computers come into being, quantum programming languages and quantum 
software development techniques will play a key role in exploiting the power of 
quantum computers. With expectation of offering effective programming techniques 
for quantum computers, several quantum programming languages have already been 
designed in recent years. The earliest proposal for quantum programming language 
was made by Knill [13]. The first real quantum programming language, QCL, was 
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proposed by Omer [16]; he also implemented a simulator for this language. A quan- 
tum programming language in the style of Dijkstra's guarded-command language, 
qGCL, was presented by Sanders and Zuliani [18]. A quantum extension of C-|— |- 
was proposed by Bettelli et al [6], and it was implemented in the form of a C-I-+ 
library. The first and very influential quantum language of the functional program- 
ming paradigm, QFC, was defined by Selinger [1^ based on the idea of classical 
control and quantum data. In [3, Altenkirch and Grattage defined another func- 
tional programming language for quantum computing, QML, in which both control 
and data may be quantum. For excellent survey of quantum programming languages, 
see [201 H]. 

The fact that human intuition is much better adapted to the classical world than 
the quantum world is one of the major reasons that it is difficult to find efficient 
quantum algorithms. It also implies that programmers will commit much more faults 
in designing programs for quantum computers than programming classical comput- 
ers. Thus, it is even more critical than in classical computing to give clear and 
formal semantics to quantum programming languages and to provide formal meth- 
ods for reasoning about quantum programs. Indeed, various semantic approaches to 
quantum programs have been proposed in recent literatures. For example, an opera- 
tional semantics was given to Sanders and Zuliani's language qGCL [18] by treating 
an observation (quantum measurement) procedure as a probabilistic choice; a de- 
notational semantics was defined for Selinger's language QPL |19j by interpreting 
quantum programs as super-operators; and a denotational semantics of Altenkirch 
and Grattage's language QML [2j was described in category-theoretic terms. In 
addition, a language-independent approach to semantics of quantum programs was 
proposed by D'Hondt and Panangaden [lOj who introduced an intrinsic notion of 
quantum weakest precondition and established a beautiful Stone-type duality be- 
tween state transition semantics and predicate transformer semantics for quantum 
programs. 

As to proof systems for reasoning about quantum programs, Baltag and Smets [U 
[Ud] presented a dynamic logic formalism of information flows in quantum systems, 
which is capable of describing various quantum operations such as unitary evolu- 
tions and quantum measurements, and particularly entanglements in multi-partite 
quantum systems. Brunet and Jorrand [8j introduced a way of applying Birkhoff 
and von Neumann's quantum logic [7] to the study of quantum programs by ex- 
panding the usual propositional languages with new primitives representing unitary 
transformations and quantum measurements. In [9], Chadha, Mateus and Sernadas 
proposed a Hoare-style proof system for reasoning about imperative quantum pro- 
grams using a quantitative state logic, but only bounded iterations are allowed in 
their programming language. Feng et al [11] found some useful proof rules for reason- 
ing about quantum loops, generalizing some of Morgan's proof rules for probabilistic 
loops [H]. To the author's best knowledge, however, no complete Hoare logic for 
quantum programs has been reported in the literature. 

The main contribution of the present paper is the establishment of a full-fledged 
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Hoare logic for deterministic quantum programs based on Selinger's idea of model- 
ing quantum programs as super-operators and D'Hondt and Panangaden's notion of 
quantum predicate as an Hermitian operator [TU]. This logic includes a proof sys- 
tem for partial correctness and a proof system for total correctness of deterministic 
quantum programs. In particular, we are able to prove its (relative) completeness 
by exploiting the power of weakest preconditions and weakest liberal preconditions 
for quantum programs. 

The paper is organized as follows: For convenience of the reader, we recall some 
basic concepts of Hilbert spaces as well as the fundamental postulates of quantum 
mechanics in Section 2. Another aim of Section 2 is to fix notation used in the sequel 
sections. In Section 3, we define the syntax of deterministic quantum programs about 
which the Hoare logic presented in this paper is designed to reason. Such quantum 
programs are quantum extension of classical while-programs (cf. [3], Chapter 3). 
In Section 4, an operational semantics of quantum programs is given in terms of 
transitions between quantum configurations, which consist of a quantum program 
still to be executed and a (partial) density operator expressing the current state of 
program variables. In Section 5, we are able to introduce a denotational semantics 
of quantum programs based on the operational semantics. A denotational semantics 
of a quantum program is defined to be a function from partial density operators to 
themselves. In Section 6, we adopt D'Hondt and Panangaden's definition of quan- 
tum predicates as Hermitian operators. Then a correctness formula is defined to 
be a quantum extension of Hoare triple, which consists of two quantum predicates, 
namely precondition and postcondition, as well as a quantum program. Further- 
more, the notions of partial and total correctness can be introduced for quantum 
programs using their denotational semantics. In Section 7, weakest precondition 
and weakest liberal precondition for quantum programs are defined in terms of total 
and partial correctness, respectively, in a familiar way. With the long preparation 
of the previous sections, the Hoare logic for quantum programs is finally established 
in Sections 8 and 9. In Section 8, a proof system for partial correctness of quantum 
programs is presented, and its (relative) completeness is proved, and in Section 9, 
after introducing the notion of bound function for quantum loops, a proof system 
for total correctness of quantum programs is given, and its (relative) completeness is 
also proved. A brief conclusion is drawn and some open problems for further studies 
are pointed out in Section 10. 



2 Preliminaries 
2.1 Hilbert Spaces 

We write C for the set of complex numbers. For each complex number A G C, A* 
stands for the conjugate of A. A (complex) vector space is a nonempty set TL together 
with two operations: vector addition + : 7i x TC ^ TC and scalar multiplication 
■ : C X TC ^ TC, satisfying the following conditions: 
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1. (7^, +) is an abelian group, its zero element is called the zero vector; 

2. = \^); 

3. X{fJ.\f)) = A/ijv?); 

4. {X + f^)\ip) = X\(p) + f^\(p)■, and 

5. X{\ip) + m=X\ip)+X\i;) 

for any A, G C and \(p),\il)) G 7^. 

An inner product over a vector space 7^ is a mapping (-I-) : HxH ^ C satisfying 
the following properties: 

1- ('^l'^) > with equality if and only if |(^) = 0; 

2. (iflij) = and 

3. {iflXitpi + A2'i/'2) = Ai(</?|V'l) + A2(¥?|V'2) 

for any lyj), |?/;), |^2) £ 'H and for any Ai,A2 G C. Sometimes, we also write 
l-^)) for the inner product {(flip) of \(p) and \^). 

For any vector \ip) in its length \ \ip\\ is defined to be a/ (V'I^)- ^ vector |^) 
is called a unit vector if WtpW = 1. Let {IV'n)} be a sequence of vectors in H and 

G 7^. If for any e > 0, there exists a positive integer N such that HV'm — i^nW < e 
for all m,n > N , then {l^/'n)} is called a Cauchy sequence. If for any e > 0, there 
exists a positive integer N such that — V'll < £ for =^11 n> N, then is called 
a limit of and we write = lim^^oo [tpn)- 

A family {|'i/'i)}ie/ of vectors in H is said to be summable with the sum l'^) and 
we write |V') = J2iei IV'i) if foi" ^^^Y e > there is a finite subset J of I such that 

for every finite subset K oi I containing J. A family {|V'i)}ie/ of ^iiit vectors is 
called an orthonormal basis of H if 

1. \ipi) ± \ipj) for any i,j & I with z 7^ and 

2- IV') = Ei67(V'#)IV'i) for each |V) G 7<. 

In this case, the cardinality of / is called the dimension of H. 

A Hilbert space is defined to be a complete inner product space; that is, an inner 

product space in which each CaTichy sequence of vectors has a limit. According to 
a basic postulate of quantum mechanics, the state space of an isolated quantum 
system is represented by a Hilbert space, and a pure state of the system is described 
by a unit vector in its state space. 



4 



Example 2.1 1. The state space of qubits is the 2— dimensional Hilbert space: 

^2 = {a|0) :a,(3eC}. 

The inner product in H2 is defined by 

(a|0) +/3|l),a'|0) = a*a' + P*P' 

for all a, a', 13, 13' G C. Then {|0),|1)} is an orthonormal basis ofTi.2, called 
the computational basis. 

2. The space I2 of square summable sequences is 

00 00 
Woo = { Cin\f^) : ttn € C for all n G Z and IcKnP < 00}, 

n=— 00 n=— 00 

where Z is the set of integers. The inner product in Hoo is defined by 

00 00 00 

( an\n), a'\n)) = ^ a^a^, 

n=— 00 n=— 00 n=— 00 

for all an, a'^ € C, —00 < n < 00. Then {|n) : n G Z} is an orthonormal basis 
ofHoo, called the computational basis. 

A (linear) operator on a Hilbert space 7^ is a mapping A:H^H satisfying the 
following conditions: 

1. A{\^) + \^))=A\^)+A\^l;y, 

2. AiXm = A^IV) 

for all £ A G C. If {jV'j)} is an orthonormal basis of TC, then an 

operator A is uniquely determined by the images of basis vectors 

under A. In particular, A can be represented by matrix 

A = mm))ij 

when H is finite-dimensional. 

An operator ^ on ?Y is said to be bounded if there is a constant C > such that 
^ for all G H. In this paper, we only consider bounded operators. 

We write JO-{H) for the set of bounded operators on H. The identity operator on H 
is denoted ly,, and the zero operator on H that maps every vector in H to the zero 
vector is denoted 0-^. 

For any operator A on H, there exists a unique linear operator A^ on H such 
that 

{\^),Am = {A^\^),\^)) 
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for all \(p), IV') € H. The operator is called the adjoint of A. An operator M on 
H, is said to be Hermitian if Af^ = M. 

An operator ^ on 7^ is said to be positive if (V'l^lV') ^ for all states \ip) 
We can define a partial order between operators, called the Lowner partial order : 
for any A,Be JC.{H), A^B if B — A is a positive operator. 

Lemma 2.1 A^ B if and only iftr{Ap) < tr{Bp) for all density operators p. 

An operator A is said to be a trace operator if {{ipi\A\'il;i)}i^j is summablc for 
any orthonormal basis {|V'i)}ie7 of H; in this case, the trace tr{A) of A is defined to 
be 



where {| V'j)} is an orthonormal basis of H- It can be shown that tr{A) is independent 

of the choice of 

A density operator p on a Hilbert space H is defined to be a positive operator 
with tr{p) = 1. Then a mixed state of a quantum system with state space H is 
described by a density operator on Ti. In this paper, wc take a slightly generalized 
notion of density operator in the sequel: a partial density operator p is a positive 
with tr{p) < 1. In particular, the zero operator is a partial density operator. The 
set of partial density operators is denoted V~{TL). A partial density operator can 
also be defined by an ensemble of pure states. Suppose that a quantum system is 
in one of a number of pure states with respective probabilities pi, where it is 
required that YliPi ^ 1- Then 



is a density operator. Conversely, any density operator can be generated in such a 
way. 

2.2 Unitary Transformations 

An operator J7 on 7^ is called a unitary transformation if U'^U = Id-^, where /d-^ is 
the identity operator on H; that is, Id-j-clip) = for all G H. 

Example 2.2 1. The most frequently used unitary operators on qubits are the 
Hadamard transformation: 



tr{A) = Y,mAm 




and the Pauli matrices: 
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2. Let k be an integer. Then the k— translation operator on Hoo is defined by 

C/+fc|n) = \n + k) 
for all n G Z. It is easy to verify that U+k is a unitary operator. 



The basic postulate of quantum mechanics about evolution of systems may be 
stated as follows: Suppose that the states of a closed qiiantum system at times t^ 
and t are \'tpQ) and | -;/;), respectively. Then they are related to each other by a unitary 
operator U which depends only on the times to and t, 

This postulate can be reformulated in the language of density operators as follows: 
The state p of a closed quantum system at time t is related to its state po at time 
tQ by a unitary operator U which depends only on the times t and t^, 

p = [/poC/^ 



2.3 Quantum Measurements 

A quantum measurement on a system with state space H is described by a collection 
{Mjn} of operators on H satisfying 

m 

where are called measurement operators, and the index m stands for the mea- 
surement outcomes that may occur in the experiment. If the state of a quantum 
system is \'tp) immediately before the measurement, then the probability that result 
m occurs is 

p{m) = (^IMt^M^I^) 
and the state of the system after the measurement is 

I , , MM 

\Vm) 



m 



We can also formulate the quantum measurement postulate in the language of den- 
sity operators. If the state of a quantum system was p immediately before measure- 
ment {Myn} is performed on it, then the probability that result m occur is 

p{m) = tr{MlM^p), 
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and the state of the system after the measurement is 

_ MmpMl 
Pm — / \ ■ 

p[m) 

A special class of quantum measurements will be frequently used in the sequel: 
If a measurement M has only two outcomes, say and 1; that is, M = {Mq,Mi}, 
then we often call M a yes-no measurement, with corresponding to "no" and 1 to 
"yes". 

2.4 Tensor Products of Hilbert Spaces 

The state space of a composite quantum system is the tensor product of the state 
spaces of its components. In this subsection, we recall the definition of the tensor 
product of a family {TCi} of Hilbert spaces. For simplicity of presentation, it will 
be assumed that the set of quantum variables is countably infinite, and the type 
of each quantum variable is either Boolean or integer (see next section). Thus, 
we only need to consider a finite or countably infinite family {TCi} where each TCi is 
finite-dimensional or countably infinite-dimensional. A more general notion of tensor 
product introduced by von Neumann pi] should be adopted in order to generalize 
the results obtained in this paper to the case of more quantum variables and other 
types. 

Let be an orthonormal basis of Tii for each i. We write B for the set of 

tensor products of basis vectors of all TCf, that is, 

^ = {(2)iV'.,.)}. 

i 

Then ;S is a countably infinite set, and it can be written in the form of a sequence 
of vectors: 

I3 = {\ipn) : n = 0,l,...}. 
The tensor product of {TCi} is defined to be the Hilbert space spanned by B, i.e. 

TCi = \^n) : an £ C for all n > and janP < oo}. 

in n 

We define the inner product in (^iTCi as follows: 

n n n 

for any q„, G C, n > 0. It is easy to see that ^iTCi is isomorphic to TCoo- 

The notion of partial trace is very useful for description of a subsystem of a 
composite quantum system. Let TC and /C be two Hilbert spaces and operator 
A G C{TC /C). Then the partial trace of A on is defined to be 

triciA) = Y,{ln ® {i^i\)p{lH ® IV'i)), 

i 
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which is an operator on TC, where {IV'j)} is an orthonormal basis of /C. It can be 
shown that tric{A) does not depend on choice of {{ipi)}. In particular, if Tii and 
H2 are the state spaces of quantum systems qi and q2, respectively, and the state 
of their composite system qiq2 is described by a density operator p £ V~{TL\ (8) "^2), 
then tr-j-i^^p) is the description for the state of component system qi. 

3 Syntax of Quantum Programs 

We assume a countably infinite set Var of quantum variables. The symbols q, q', q" , 
Q0iQi,Q2, ■■■ will be used as meta- variables ranging over quantum variables. Recall 
that in classical computation, we use a type to denote the domain of a variable. 
Thus, in quantum computation, a type should be the state space of a quantum 
system denoted by some quantum variable. Formally, a type t is a name of a Hilbert 
space TCt- In this paper, we only consider two basic types: Boolean, integer. The 
results obtained in this paper can be easily generalized to the case with more types. 
The Hilbert spaces denoted by Boolean and integer are: 

^Boolean — 
^integer — ^oo' 

Note that the sets denoted by types Boolean and integer in classical computation 
are exactly the computational bases of ^Boolean and Winteger, respectively (see 
Example 12. ip . Now we assume that each quantum variable q has a type type{q), 
which is either Boolean or integer. The state space TCq of a quantum variable q is 
the Hilbert space denoted by its type; that is, 

A quantum register is defined to be a finite sequence of distinct quantum vari- 
ables. The state space of a quantum register q = qi, ...,qn is the tensor product of 
the state spaces of the quantum variables occurring in q; that is, 

n 

nq = ®nq^. 

i=l 

Now we are able to define the syntax of quantum programs. The quantum pro- 
grams considered in this paper are quantum extension of classical while-programs. 
Formally, they are generated by the following grammar: 

S ::= skip \ q := {) \q := Uq \ Si; S2 \ measure M\q\ : S \ while M[q] = 1 do S 

where 

• q is a quantum variable and q a quantum register; 
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• [7 in the statement "g := Uq" is a unitary operator on TCg. In particu- 
lar, if type{q) = integer, then the statement q := U^kQi where U^k is the 
fe— translation operator, will be often abbreviated to q := q + k; 

• in the statement "measure M[q] : , M = {M^} is a measurement on the 
state space Hq of q, and S = {Sm} is a set of quantum programs such that 
each outcome m of measurement M corresponds to Sm', 

• M = {Mo, Ml} in the statement "while M\q] = 1 do S"'is a yes-no measure- 
ment on Hq. 

The intuitive meaning of these quantum program constructs will become clear 
after introducing their operational semantics in the next section. 

The following technical definition will be needed in the sequel. 

Definition 3.1 The set var{S) of quantum variables in quantum program S is re- 
cursively defined as follows: 

1. IfS = skip, then var{S) = 0; 

2. IfS = q:=0, then var{S) = {q}; 

3. If S = q:= Uq, then var{S) = {q}; 

4- If S = Si;S2, then var{S) = var{Si) U war (52); 

5. If S = measure M[q] : S, then 

var{S) = {q}u[Jvar{Sm); 

m 

6. IfS = while M[q] = 1 do S, then var{S) = {q} U var{S). 

4 Operational Semantics of Quantum Programs 

We write T^aii for the tensor product of the state spaces of all quantum variables, 
that is, 

T^all = Tiq. 

all q 

For simplicity of presentation, we will use E to denote the empty program. A 
quantum configuration is a pair {S,p), where S" is a quantum program or E, p £ 
'D~(7ia.ii) is a partial density operator on Haii, and it is used to indicate the (global) 
state of quantum variables. 

Let g = gi, g„ be a quantum register. A linear operator A on Hq has a cylinder 
extension 

A ® Ivar-{q} (1) 
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on Hall, where Iyar-{q} is the identity operator on the Hilbert space 

(g) n,. 

q£Vai — {q} 

In the sequel, we will simply for A for its extension ([T|), and it can be easily recognized 
from the context, without any risk of confusion. 

The operational semantics of quantum program is defined to be a transition 
relation — > between quantum configurations. By a transition 

{S,p)^{S',p') 

we mean that after executing quantum program S one step in state p, the state of 
quantum variables becomes p' , and S' is the remainder of S still to be executed. In 
particular, if S' = E, then S terminates in state p'. The transition relation — > is 
given by the transition rules in Fig.l. 

The meanings of various program constructs are precisely specified by the tran- 
sitional rules in Fig.l. The statement "skip" does nothing and terminates immedi- 
ately. The initialization "g := 0"sets quantum variable q to the basis state |0). To see 
the role of initialization more clearly, we consider the case of type{q) = integer as 
an example. First, suppose /) is a pure state; that is, p = |^)(^| for some |^) G Wall- 
We can write jV') in the form: 

k 

where IV'fc) is a product state, say 

l^fc) = (g) l^fcg'). 

all q' 

Then 

P = '^'^kOtl\'^k){'ilJl\- 
k,l 

After the initialization the state becomes: 

oo 

Po= E |0),H/9|n)„(0| 

n=— oo 

oo 

= Y.aka*i{ \^)q{n\^k)mn)qm 

k,l n=— oo 

oo 

= Y,^ka*i{ {'ipiq\n){n\i;kqmO)q{0\ (g) \i^kq'){M 

k,l n= — oo q'ytq 

= Yo^kati^l'l\^kq)i\0)q{0\ (g) \i^kq'){M) 
k,l q'ytq 

= \0)g{0\ ® {Y,<^kat{^lg\lPkq) (g) l^fcg'X^Zg'D- 
k,l q'ytq 
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In general, suppose p is generated by an ensemble {{pi, IV'i))} of pure states, that is, 

i 

For each i, we write pi = \ipi){'ipi\ and assume that it becomes p^Q after the initial- 
ization. By the above argument, we can write pio in the form: 

Pio = '^(^ik{\0)q{0\ 8> \(pik){fik\), 
k 

where \ifik) G 'H^ar-{q} foi' all k. Then the initialization makes that p becomes 

oo 

Po= E |0),(n|p|n),(0| 

n=— oo 

oo 

= Y.P^{ E I0),(n|ft|n),(0|) (3) 

i 71=— oo 

= ^^Piaik{\G)q{Q\ ® \'^ik){^ik\)- 
i,k 

From Eqs. ([2]) and ^ we see that the state of q is set to be |0) and the states of the 
other quantum variables are unchanged. The statement "g := C/g" simply means that 
unitary transformation U is performed on quantum register q, leaving the states of 
the quantum variables not in q unchanged. Remark that U in the target configura- 
tion of the rule (Unitary Transformation) stands indeed for the cylinder extension of 
U on TCaii (see Eq. ([I|)). A similar remark applies to the rules for measurements and 
loops. Sequential composition is similar to its counterpart in classical computation. 
The program construct "measure M[g] : 5" is a quantum generalization of classi- 
cal conditional statement. Recall that the first step of the execution of conditional 
statement "if B then Si else 52 fi"is to check whether Boolean expression B is 
satisfied. However, according to a basic postulate of quantum mechanics, the unique 
way to acquire information about a quantum system is to perform a measurement 
on it. So, in executing the statement "measure M[g] : 5"', quantum measurement 
M will first be performed on quantum register q, and then a subprogram Sm in S 
will be selected to be executed next according to the outcome of measurement. The 
essential difference between a measurement statement and a classical conditional 
statement is that the state of program variables is changed after performing the 
measurement in the former, whereas it is not changed after checking the Boolean 
expression in the latter. Note that the outcome m is observed with probability 

Pm = tr{MmpMl), 

and after the measurement the state becomes 

Pm = MmpMl^/pm- 
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So, a natural presentation of the Measurement rule is the probabilistic transition: 



(measure M[q] : S,p) {Sm, Pm) 

However, we adopt Selinger's suggestion [19] of encoding both probability pm and 
density operator pm into partial density operator 

MmpMj^ = PmPm- 

This allows us to give the Measurement rule in terms of ordinary transition. The 
statement "while M[g] = 1 do 5" is a quantum generalization of classical loop 
"while B do S od" . To acquire information about quantum register q, a measure- 
ment M is performed on it. The measurement M is a yes-no measurement with 
only two possible outcomes 0, 1. If the outcome (no) is observed, then the pro- 
gram terminates, and if the outcome 1 (yes) occurs, then the program executes the 
subprogram S and continues. The only difference between a quantum loop and a 
classical loop is that checking the loop guard B in a classical loop does not change 
the state of program variables, but in a quantum loop the measurement outcomes 
and 1 occur with probabilities: 

po = tr{MopMl), pi = tr{MipMl), 

respectively, and the state becomes M^pM^ from p when the outcome is 0, and it 
becomes MipAdl when the outcome is 1. Again, we adopt Selinger's suggestion so 
that the (Loop 0) and (Loop 1) rules can be stated as ordinary transitions instead 
of probabilistic transitions. 

Let be a quantum program and p G V~{'H). If {S',p') can be reached from 
{S,p) in n steps in the transition relation that is, there are configurations 
(S'i,pi), {Sn-i,Pn-i) such that 

{S,P) {Sl,Pl) ... {Sn-l,Pn-l) {S',p'), 

then we write: 

{S,p) {S',p'). 

A transition sequence of S starting in /) is a finite or infinite sequence of configura- 
tions in the following form: 

{S,p) {Si,pi) ... {Sn,Pn) {Sn+l,Pn+l) ^ •••• 

If it cannot be extended, then it is called a computation of 5* starting in p. Moveover, 
if it is finite and its last configuration is {E,p'), then we say that it terminates in 
p'; and if it is infinite, then we say that it diverges. We say that S can diverge from 
p whenever it has a diverging computation starting in p. 

Classical while-programs are a typical class of deterministic programs that 
have exactly one computation starting in a given state. As shown in the follow- 
ing example, however, quantum while-programs no longer possess such a deter- 
minism because probabilism is introduced by the measurements in the statements 
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"measure M{q] : S"'and "while M[q] = 1 do 5"'. After encoding probabilities into 
partial density operators, probabilism manifests as nondeterminism in transition 
rules (Measurement), (Loop 0) and (Loop 2). 

Example 4.1 Suppose thattype{qi) = Boolean andtype{q2) = integer. Consider 
the program: 



• M is the measurement according to the computational basis {|0),|1)} 0/0.2; 
that is, M = {Mo, Ml}, Mq = |0)(0| and Mi = |1)(1|; 

• S = Si, S2, and 

— Si = skip; 

— ^2 = while N[q2] = 1 do gi := azqi, where N = {Nq, Ni}, 



S = qi := 0; q2 := 0; qi := Hqi;q2 := q2 + 2; measure M[qi] : S 



where 



00 




n=— 00 n=l 



Let 



Po= (g) |0),(0| 




p=\l)q,{l\^\-l)q^{-l\^PO. 

Then the computations of S starting in p are: 



{S, p) {q2 := 0; qi := Hqi; q2 := q2 + 2; measure, pi) 
{qi := Hqi; q2 := q2 + 2; measure, P2) 
{Q2 ■= q2 + 2; measure, ps) 
— > (measure, p^) 

\ {Sl,P5) {E,P5), 




{S2,Pe) {qi ■= (^zqi\S2,PQ) 

^{82, -Pe) 



^" {qi ■■= cTzqi]S2, 

(S2,(-1)V6) 
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where measure stands for the statement 'Measure M[gi] : S", and 

pi = \O)g,{O\0\-l)g^{-l\^PO, 

PS = |+)gi(+|» 10)52(01 «>Po, 

P4 = |+)gi(+|® 12)52(21 ®P0, 
/>5 = ^10)51(01 012)52(21 0/90, 

/>6 = ^11)51(11 » 12)52(21 0/>O. 
So, S can diverge from p. Note that S2 has also the transition 

(S2,(-l)>6)-(i?,0H„„), 

but we always discard the transitions in which the partial density operator of the 
target configuration is zero operator. 

5 Denotational Semantics of Quantum Programs 

The denotational semantics of a quantum program is defined to be a semantic func- 
tion which maps partial density operators to themselves. More precisely, for any 
quantum program S, the semantic function of S sums the computated results of all 
terminating computations of S. 

We write — >* for the reflexive and transitive closures of — >; that is, {S,p) 
{S' , p') if and only if {S,p) — {S',p') for some n > 0. 

Definition 5.1 Let S be a quantum program. Then its semantic function 

[\s\] :v-{n^n)^v-{n^ii) 

is defined by 

[\S\]ip)=Y,{\p'--{S,p)^*{E,p')\} (4) 

for all p G Wall- 

It should be pointed out that {| • |} in Eq. (j3j) stands for multi-set. The reason 
for using multi-sets is that the same density operator may be obtained through 
different computational paths as we can see from the measurement and loop rules in 
the operational semantics. The following simple example illustrates the case more 
explicitly. 

Example 5.1 Assume that type{q) = Boolean. Consider the program: 
S = q := 0; q := Hq; measure M[q] : S, 

where 
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• M is the measurement according to the computational basis {|0), |1)} 0/7^2; 

• S = So, Si, So = q := Iq and Si = q := a^q- 

Let p = |0)aii(0|, where 

|0)all = (g)|0),. 
all q 

Then the computation of S starting in p is given as follows: 

{S, p) {q := Hq; measure, p) 

^ (measure, \+)g{+\ C5 (g) |0),,(0|) 




(5i,i|i),(i|®(8)^,^jov(o|)^(£;,ip), 



where measure is an abbreviation of "measure M[q] : S". So, we have: 

[\s\]{p) = Ip+Ip = p. 

Now we are going to establish some basic properties of semantic functions. First, 
we prove its linearity. 

Lemma 5.1 Let pi,p2 € V~{D) and Ai, A2 > 0. // Aipi + A2/92 £ then for 

any quantum program S, we have: 

[\S\]{Xipi + A2P2) = M\S\]{pi) + A2[|5|](p2). 

Proof. We can easily prove the following fact by induction on the structure of S: 

• Claim: If {S,pi) {S',p[) and {S,p2) ^ {S',p'2), then 

{S, Xipi + A2P2) {S', Xip'i + A2P2). 

Then the conclusion immediately follows. □ 

Next we give a representation of semantic function [|5'|] according to the structure 
of program S. To do this for quantum loops, we need some auxiliary notations. Let 
ri be a quantum program such that = for all p G ViTi); for example, 

O = while Mtriviail?] = 1 do skip, 

where g is a quantum variable, and 

Mtriviai = {Mo = Qn,,Mi = In,} 
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is a trivial measurement on TCg. We set: 



(while M[q] = 1 do Sf = 
(while M[q] = 1 do 5)"+^ = measure M[q] : S, 



where S = So, Si, and 



50 = skip, 

51 = S; (while M[q] = 1 do S)"" 



for all n > 0. 



Proposition 5.1 1. [|skip|](p) = p. 

2. If type{q) = Boolean, then 

[\q := 0|](p) = |0),(0|p|0),(0| + |0)g(l|p|l),(0|, 
and if type{q) = integer, then 

oo 

[\Q-=mp) E \0)g{n\p\n)g{0\. 

n=— oo 

3. [\q:=Uq\]{p)=UpUl 

4. [\Si;S2\]{p) = [\S2m\Si\]{p)). 

5. [Imeasure M[q] : S\]{p) = j:j\Sm\]{MrapML). 

6. [|while M\g\ = 1 do S\]{p) = V^=o[l(while M\g\ = 1 do 5)"|](p). 

Proof. (1), (2) and (3) are obvious. 

(4) By Lemma [5. II and the transitional rule for sequential composition we obtain: 

\\S2m\Si\]{p)) = [\S2\]{Y,{\pi : {Si,p) {E,pi)\]) 
= E{l[l^2|](pi):(5i,p) {E,pi)\} 

= E{lE{l^' - {E,p')\} : {Si,p) {E,pi)\} 

= Y,{\P' ■■ {Si,p) ^* {E,pi) and (52, pi) ^* {E,p')\} 

= J2{\p'--{Si;S2,p) - {E,p')\} 

= [\Si;S2\]{p). 

(5) follows immediately from the transitional rule for measurement. 
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(6) We introduce two auxiliary operators: 



£^{p) = MipMj 

for all p E T>~[7i) and i = 0, 1. For simplicity, we write while for "while M[g] = 
1 do S"'. First, we prove: 

[\{^\n\erW{p) = Y,[£,o{[\S\]o8,f]{p) 

k=0 

for all n > 1 by induction on n. The case of n = 1 is obvious. Then by (1), (4) and 
(5) and the induction hypothesis on n — 1 we obtain: 

[|(while)"|](p) = [|skip|](^:o(p)) + [\S; (while)-|](^:i(p)) 
= £oip) + [\i^hiler-'\mS\]o£,)ip)) 

n-2 

= Soip) + Y.[£oo {[\S\] o £^m[\S\] o S,){p)) (5) 

k=0 

n-1 

= Y^[£oo{[\S\]o£,f]ip). 

k=0 

Second, we have: 

[|while|](p) = Y,{\p' : (while,p) ^* {E,p')\} 

oo 

= EEil/''^<^hile,p) ^" {E,p')\}. 

n=l 

So, it suffices to show that 

Y^{\p' : (while, p) {E,p')\} = [So o i[\S\] o £,r-^]{p) 

for all n > 1. This can be easily done by induction on n. □ 

If we only consider quantum variables of type Boolean, then the above propo- 
sition coincides with Fig.l in pjj. However, it is worth noting that in [11] the 
denotational semantics of quantum programs was directly defined and it lacks a 
basis of operational semantics. Similar to Lemma 3.2 in [11], we may prove that 
the semantic function of a quantum program is a super-operator. Thus, the denota- 
tional semantics given in this section is consistent with Selinger's idea of modeling 
quantum programs as super-operators [19j . 

A recursive characterization of the semantic function of a quantum loop can be 
derived from the above proposition. 
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Corollary 5.1 If we write while for quantum loop 'Svhile M[q] = 1 do S", then 
for any p G T>^{7iaii), it holds that 

[|while|](p) = MopM^o + [|while|]([|5|](MipM|)). 
Proof. Immediate from Proposition 15.1( 6) and Eq. ([5]). □ 

The following proposition shows that a semantic function does not increase the 
trace of density operator of quantum variables. 

Proposition 5.2 For any quantum program S, it holds that 

tr{[\S\]{p))<tr{p) 

for all pGV~{n^ii). 

Proof. We proceed by induction on the structure of S. 

Case 1.5 = skip. Obvious. 

Case 2. S = q := 0. If type{q) = integer, then 

oo 

tr{[\S\]{p)) = ^ tr{\0),{n\p\nU{0\) 

n=— oo 
oo 

= tr{gmg{n\p\n)g) 

n=—oo 
oo 

= tr[{ \n)g{n\)p] = tr{p). 

n=—oo 

It can be proved in a similar way when type{q) = Boolean. 
Case 3. S = q := Uq. Then 

tr{[\S\]{p) = tr{UpU^) = tr{U^Up) = tr{p). 

Case 4. 5 = 5*1; 5*2. It follows from the induction hypothesis on and 52 that 

tr{[\S\]{p)) = tr{[\SM\Si\]{p))) 
<tr{[\S,W{p)) 
< tr{p). 

Case 5. 5 = measure M\jf\ : 5. Then by induction hypothesis we obtain: 
tr{[\S\]{p)) = Ytr{[\Smm^pMl)) 

m 

<YHM^pMl) 

m 

= tr[C£MlM^)p\ 

m 

= tr{p). 
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Case 6.5 = while M[g] = 1 do 5". We write (while)"- for statement "(while M[q] 
1 do S")"". With Proposition 15.1( 6). it suffices to show that 

tr([|(while)"|](p))<tr(p) 

for all n > 0. This can be carried out by induction on n. The case of n = is 
obvious. By the induction hypothesis on n and 5', we have: 

tr([|(while)"+i|](p)) = tr(MopMo^) + tr([|(while)"i]par([|5'|](MipM|))) 

< triM^pMl) + tr{[\S'\]{MipMl)) 

< tr{MopMl) + tr{MipMl) 
= tr[{MlMo + M\Mr)p\ 

= tr{p). □ 

Prom the proof of the above proposition, it is easy to see that the unique possi- 
bility that i?'([|S'|](/9)) < tr{p) comes from the quantum loops occurring in 5. Thus, 
tr{p) — tr{\\S\]{p)) is the probability that program S diverges from input state p. 
This can be further illustrated by the following example. 

Example 5.2 Let type{q) = integer, and let 



oo 



, 2n 

n=l 



n=l 

Then M = {Mq,Mi} is a yes-no measurement on Tig. Consider the program: 

while M[q\ = 1 do q := q + 1. 
For simplicity, we write while for this program. Let 



and p = |0)q(0| (8> po- Then 
[|(while)"|](p) = 



PO = ^\0)g'{0\ 



Ow,n if n = 0,1, 2, 



1 °° n — 1 
[|while|](p) = -(^ !L_|n)g(n|) ® po, 

n=2 



and 



1 °° T7 - 1 1 

ir([|while|](p)) = -^-— = - 



2 ^ n! 2 

n=2 



This means that program while terminates on input p with probability ^, and it 
diverges from input p with probability ^ . 
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To conclude this section, we observe how quantum programs change the states 
of quantum variables and how they access quantum variables. 

Let X C Var be a set of quantum variables. For any A G CiTLau)-, we write 
trxi-A) for 

Proposition 5.3 1. tr^ar{S){[\SW{p)) = tr^aT{S){p)- 

2- If trvar-var(S)iPl) = 'trvar-var{S){P2), then 

t^Var—var(S) i[\S\]{Pl)) = trvar-var{S)i[\S\]{p2))- 

We put the long and dumb proof of the above proposition into the appendix. 

Recall that trx{p) describes the state of the quantum variables not in X when 
the global state of all quantum variables is p. So, Proposition 15.3^ 1) indicates that 
the state of the quantum variables not in var{S) after implementing quantum pro- 
gram S is the same as that before implementing S. This means that program S 
can only change the state of quantum variables in var{S). On the other hand. 
Proposition I5.3f 2) shows that if two input states pi and p2 coincide on the quan- 
tum variables in var{S), then the computed outcomes of S, starting in pi and p2, 
respectively, will also coincide on these quantum variables. In other words, program 

5 can access at most the quantum variables in var(S). 

6 Correctness Formulas 

Correctness of a quantum program will be expressed by a quantum extension of 
Hoare triple in which a quantum predicate describes the input state and a quan- 
tum predicate describes the output states of the program. We adopt D'Hondt and 
Panangaden's definition of quantum predicates yLOj. For any X C Var, a quantum 
predicate on TCx is defined to be a Hermitian operator P on 7ix such that 

We write ViTix) for the set of quantum predicates on Tlx- Intuitively, for any 
p G V~iTLx)i tr{Pp) stands for the probability that predicate P is satisfied in state 
P- 

A correctness formula is a statement of the form: 

{P}S{Q} 

where 5 is a quantum program, and both P and Q are quantum predicates on TCaii- 
The quantum predicate P is called the precondition of the correctness formula and 
Q the postcondition. A correctness formula can be interpreted in two different ways: 
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Definition 6.1 1. The correctness formula {P}S{Q} is true in the sense of total 
correctness, written 

Hot {P}S{Q}, 

if we have: 

tr{Pp)<tr{Q[\S\]{p)) 

for allpG V-{n). 

2. The correctness formula {P}S{Q} is true in the sense of partial correctness, 
written 

Hpar {P}S{Q}, 

if we have: 

tr{Pp) < tr{Q[\S\]{p)) + Mp) - tr{[\S\]{p))] 
for allpeV-{n). 

The intuitive meaning of the defining inequahty of total correctness is: the prob- 
abihty that input p satisfies quantum predicate P is not greater than the probabihty 
that quantum program S terminates on p and its output [[^^(p) satisfies quantum 
predicate Q. Recall that tr{p) — tr{[\S\]{p)) is the probability that quantum program 
S diverges from input p. Thus, the definition inequality of partial correctness means: 
if input p satisfies predicate P, then cither program S terminates on it and its output 
satisfies Q, or S diverges from it. The difference between total correctness 
and partial correctness is illustrated well by the following simple example. 

Example 6.1 Assume that type{q) = Boolean. Consider the program: 

S = while M[q] = 1 do g := azQ 

where Mo = |0)(0| and Mi = |1)(1|. Let P = \ilj)q{'tp\^P' , where = q;|0) + /3|1) G 
n2, and P' er{nvar-{q})- Then 

\=tot {P}S{\O)g{O\0P'} 

does not hold i/ /? / and P ^ Onvar-{q} ■ -^'^ f^^'^^j P'^^ 
Then 

[|^|](p) = I«I'|o),(o|®/h,_^,> 

and 

tr{Pp) = tr{P') > \a\Hr{P') = tr((|0),(0| ® P')[\S\]{p)). 
On the other hand, we always have: 

Har {P}S{\0)g{0\^P'}. 
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To show this, we first consider a special class of partial density operators onTCvar-{q}' 
P = \^)g{^\ ® P'j where \(p) = a\0) + b\l) e H2, and p' G T)^ ^yar-{q\)- ^ routine 
calculation yields: 

[\S\]{p) = \a\'mO\ ^ p' 

and 

triPp) = M^)\HriP'p') 

< \a\^tr{P'p') + [tr{p') - \a\'^tr{p')] 

= tr((|0),(0| P')[\S\]ip)) + Mp) - tr{[\S\]{p))]. 

Then it follows from linearity of [\S\] (Lemma \5.1\) that 

tr{Pp) < tr((|0),(0| P')[\S\]{p)) + Mp) - tr{[\S\]{p))] 

for all p G V^{Haii)- 

The following proposition presents some basic properties of correctness formulas. 

Proposition 6.1 1. If ^tot {P}S{Q}, then |=pa, {P}S{Q}. 

2. For any quantum program S, and for any P,Q€z V{'Ha.ii), we have: 

Hot {On.n}S{Q}, Npar {P}S{In^J. 

3. Linearity: For any Pi,P2,Qi,Q2 S 'P('Haii) and Ai,A2 > with XiPi + 

A2P2,AiQi + A2Q2G7'(Wall), tf 

Hot {Pi}S{Qi} {i = l,2), 

then 

\=tot {AlPi + A2P2}5{Aigi + A2Q2}. 
The same conclusion holds for partial correctness if Xi + X2 = 1. 

Proof. Immediate from definition. □ 

7 Weakest Preconditions and Weakest Liberal Precon- 
ditions 

As in the case of classical Hoare logic, the notions of weakest precondition and 
weakest liberal precondition of quantum program will play a key role in establishing 
the (relative) completeness of Hoare logic for quantum programs. They may be 
defined in a familiar way: 

Definition 7.1 Let S be a quantum program and P G V{TCa.ii) be a quantum predi- 
cate on Hall- 
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1. The weakest precondition of S with respect to P is defined to be the quantum 
predicate wp.S.P G 7'('Haii) satisfying the following conditions: 

(a) \=tot {wp.S.P}S{P}; 

(b) if quantum predicate Q G ViHaii) satisfies \=tot {Q}'S'{-P} then Q C 
wp.S.P. 

2. The weakest liberal precondition of S with respect to P is defined to be the 
quantum predicate wlp.S.P G P('Haii) satisfying the following conditions: 

(a) {wlp.S.P}S{P}; 

(b) if quantum predicate Q G V{Haii) satisfies |=par {Q}S{P} then Q C 
wlp.S.P. 

The next two propositions give explicit representations of weakest preconditions 
and weakest liberal preconditions, respectively. They will be used in the proof of 
completeness of quantum Hoare logic. 

Proposition 7.1 1. (a) wp.skip.P = P. 

(b) Iftype{q) = Boolean, then 

wp.q := O.P = |0)g(0|P|0)g(0| + |l)g(0|P|0)g(l|, 
and iftype{q) = integer, then 

oo 

wp.q:=O.P= ^ \n)q{0\P\0)q{n\. 
n=— oo 

(c) wp.q := Uq.P = PU . 

(d) wp.Si\S2.P = wp.Si.{wp.S2.P). 

(e) lup.measure M[q] : S.P = Y.mMl{wp.S„,.P)Mm. 

(f) while M[g] = 1 do S.P = Vr=o^n, where 



\ Pn+i = M^PMo + Ml{wp.S.Pn)Mi for all n > 0. 

2. For any quantum program S, for any quantum predicate P G V{'Ha,\\), and for 
any partial density operator p G 'D~{Ha.n), we have: 

tr{{wp.S.P)p) =tr{P[\S\U{p)). 
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Proof. The trick is to simultaneously prove (1) and (2) by induction on the 
structure. This is indeed why we put these two conclusions that seem irrelevant at 
the first glance into a single proposition. 

Case 1. S = skip. Obvious. 

Case 2. S = q := 0. We only consider the case of type{q) = integer, and the 
case of type{q) = Boolean is similar. First, it holds that 

oo oo 

*^(( E \n)g{0\P\0),{n\)p)=tr{P ^ |0),(n|p|n),(0|) 

n=— oo n=— oo 

= tr{P[\q:=0\]{p)). 

On the other hand, for any quantum predicate Q £ V{TCau), if |=tot {Q}q ■= 0{P}, 
i.e. 

tr{Qp)<tr{P[\q:=0\]{p)) 

oo 

= tr{{ E |n),(0|P|0)g(n|)/,) 

n=— oo 

for all p £ X'^('Haii), then it follows from Lemma |2. II that 

oo 

Yl l^>g(0|^'|0),(n|. 

n=— oo 

Case 3. S = q := Uq. Similar to Case 2. 

Case 4. S = Si; 82- It follows from the induction hypothesis on Si and ^2 that 
tr{{wp.Si.{wp.S2.P))p) = tr{{wp.S2.P)[\Si\]{p)) 

= tr{p[\s2msi\m) 

= tr{P[\Si;S2\m. 

If |=tot {Q}Si; S2{P}, then for ah p G I^"(Waii), we have: 

tr{QP) < tr{P[\Si;S2\]{p)) = tr{{wp.Si.{wp.S2.P))p). 

Therefore, it follows from Lemma l2. II that Q ^ wp.Si.{wp.S2-P)- 

Case 5. S = measure M[q] : S. Applying the induction hypothesis on Sm, we 
obtain: 

tr{{Y,Ml{wp.Sm.P)M„,)p) = Y,tr{{wp.Sm.P)M.rapMl) 

m m 

= Y,HP[\SmW{M^pMl)) 

m 

= tr{PY,[\SmW{MmpMl)) 

m 

= tr(P[|measure M[q] : SW^M)- 
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If \=^^^ {Qjmeasure M[q] : S{P}, then 

tr{Qp) < tr{{Y^Ml{wp.Sm.P)Mm)p) 

m 

for all p, and it follows from Lemma l2. II that 

m 

Case Q. S = while M\cj\ = 1 do S' . For simplicity, we write (while)" for 
statement "(while M\q] = 1 do S")"". First, we have: 

tr(P„p) =tr(P[|(while)"|](p)). 

This claim can be proved by induction on n. The basis case of n = is obvious. By 
the induction hypotheses on n and 5', we obtain: 

tr{Pn+ip) = tr{MlPMop) + tr{Ml{wp.S' .Pn)Mip) 
= tr{PMopMl) + tr{{wp.S'.Pn)MipMl) 
= tr{PMopM^^)+tr{Pn[\S'\]{MipMl)) 
= tr(PMopiv4) +tr(P[|(while)"|]([|S'|]par(Mi/>M|))) 
= tr[P{MopA4 + [\S'; (while)"|](Mi/5Af|))] 
= tr(P[|(while)"+i|](p)). 

Now continuity of trace operator yields: 

oo oo 

tr{i\/ Pn)p)= \l tr{PnP) 

n=0 n=0 

oo 

= V ir(P[|(while)"|](p)) 

n=0 

oo 

= tr(P \/[|(whiler|](p)) 

n=0 

= tr(P[|while M[q] = 1 do S'\]{p)). 

So, if 

hot {gjwhile M[q\ = 1 do S'{P}, 

then 

oo 

tr{Qp)<tr{{\/ Pn)p) 

n=0 

for all p, and by Lemma [2TT] we obtain Q C \l'^=QPn- D 
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Proposition 7.2 1. (a) wlp.skvp.P = P. 
(h) Iftype{q) = Boolean, then 

wlp.q := O.P = |0)g(0|P|0),(0| + |1),(0|P|0),(1|, 

and if type{q) = integer, then 

oo 

wlp.q:=O.P= \n)g{0\P\0)g{n\. 

n=—oo 

(c) wlp.q := Uq.P = WPU. 

(d) wlp.Si; S2-P = wlp.Si.{wlp.S2-P) ■ 

(e) w/p.measure M[g] : 'S.P = Y^.^ M}n{wlp.Sm-P)Mm. 

(f) wlp.v^hile M\q] = 1 do S.P = A'^^qPu, where 

Pn+i = M^PMq + Ml{wlp.S.Pn)Mi for all n > 0. 

2. For any quantum program S, for any quantum predicate P G ViTiao), and for 
any partial density operator p G V^ijisw), we have: 

tr{{wlp.S.P)p) = tr{P[\S\U{p)) + Mp) " H[\S\]{p)]. 

Proof. Similar to the case of weakest precondition, we prove (1) and (2) simul- 
taneously by induction on the structure of quantum program 5. 

Case 1.5 = skip, or g := 0, or g := Uq. Similar to Cases 1, 2 and 3 in the proof 
of Proposition 17.11 

Case 2. S = Si; 5*2. First, with the induction hypothesis on Si and S2, we have: 

tr{wlp.Si.{wlp.S2.P)p) = tr{wlp.S2.P[\Si\]{p)) + [tr{p) - tr{[\Si\]{p))] 
= tr{P[\S2\]{[\Si\]{p)) + M[\Si\]{p)) - tr{[\S2mSi\]{pm + [tr{p) - tr{[\Si\]{p))] 
= triP[\S2mSi\m + [trip) - tri[\S2mSi\]{pm 
= tr{P[\S\m + Mp)-tr{[\S\m]. 

If |=par {Q}S{P}, then it holds that 

triQp) < tr{P[\S\]ip)) + [trip) " tri[[S[]ip))] = triwlp.Si.iwlp.S2.P)p) 

for all p G D^iTCaii), and by Lemma |2. II we obtain: 

Q Q wlp.S1.iwlp.S2-P). 
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Case 3. S = measure M[q] : S. It can is derived by induction hypothesis on all 
S^n that 

trC^Ml{wlp.Sra.P)MmP) = ^tr{Ml{wlp.S„,.P) M^p) 

m m 

= Y,triiwlp.Sm.P)MmpMl) 

m 

= Y,{tr{P[\Sm\]iM^pMl)) + MM^pMl) -triilSmmmpMlm 

m 

= ^tr{P[\S^\]{M^pMl)) + [^tr{MmpMl) -^tr{[\S^\]{MmpMl))]} 

m mm 

= tr{pY,[\Smm^pMi)) + MpY^MiMm) -tr{Y,[\SmmmpMim 

m mm 

= tr{P[\S\]{p)) + [tr{p)-tr{[\S\]{p))] 

because M^M^ = In^. If |=par {Q}S{P}, then for all p G V-{naii), it holds 
that 

tr{Qp) < tr{P[\S\]{p)) + Mp) - tr{[\S\]{p))] = tr{Y, Mi{wlp.Sm.P)Mmp). 

m 

This together with Lemma 12.11 implies 

Q ^Y.Ml{wlp.S^.P)Mm. 

m 

Case 4. S* = while M[q] = 1 do S' . We first prove that 

tr{Pr,p) = tr(P[| (while)" |](p)) + [tr{p) - tr([|(while)"|](p))] (6) 

by induction on n, where (while)" is an abbreviation of (while M[g] = 1 do S")". 
The case of n = is obvious. By induction on S' and induction hypothesis on n, we 
observe: 

tr{Pn+ip) = tr[{MlPMo) + Ml{wlp.S' .Pn)Mip\ 
= triM^PMop) + tr{Ml{wlp.S' .Pn)Mip) 
= tr{PMQpMl) + tr{{wlp.S'.Pn)MipMl) 

= tr{PM^pMl) + tr{Pn[\S'\]{MipMl)) + [tr{MipMl) - tr{[\S'\]{MipMl))] 
= tr(PMopMj) +tr(P[|(while)"|]([|5|](MipM|))) + [tr([|5|](MipM|)) 

- tr([|(while)"|]([|5|](MipMt)))] + [tr{AhpM\) - tr{[\S'W{NhpMl))] 
= tr{P[M^pMl + [|(while)"|]([|S|](MipM|))] 

+ Mp) - tr{M,pMl + [|(while)"|]([|5|](MipM|)))] 
= tr(P[|(while)"+i|](p)) + [tr{p) - tr([|(while)"+i !](/>)]. 
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This completes the proof of Eq. ([6]). Note that quantum predicate P Q I. Then 
/ — P is positive, and by continuity of trace operator we obtain: 

oo oo 

tr{{/\Pn)p)= l\tr{Pnp) 

n=0 n=0 

oo 

= /\{tr(P[|(while)"|](p)) + Mp) - tr([|(while)"|](p))]} 

n=0 

oo 

= tr(p)+ /\tr[(P-/)[|(whiler|](p)] 

n=0 

oo 

= ir(/,)+tr[(P-/) \/[l(whiler|](p)] 

n=0 

= tr{p)+tr[{P-I)[\S\]{p)] 

= tT{P[\S\]{p)) + Mp)-tr{[\S\]{p))]. 

For any Q G ViTCaii), Hpar {Q}S{P} imphes: 

oo 

tr{Qp) < tr{P[\S\]ip)) + Mp) - tr{[\S\]ip)) = tr{{ /\ P^)p) 

n=0 

for all p £ V~{l-Laii). This together with Lemma [27T] leads to Q E f\^=QPn- D 

We see that Propositions 17.11 and 17.21 coincide with Figs. 2 and 3, respectively, 
in [llj when only quantum variables of type Boolean are considered. But Figs. 2 
and 3 in [llj are given directly as definitions, and their intuitive meanings are not 
clear because they do not have any connection to total and partial correctness of 
quantum programs. In contrast. Propositions 17. II and 17.21 fill in such a gap, and they 
are derived from Definition 17.11 which is given entirely based on the notions of total 
and partial correctness of quantum programs. 

The next proposition gives a recursive characterization of weakest precondition 
and weakest liberal precondition of quantum loop, and it provides a key step in the 
proof of completeness of quantum Hoare logic. 

Proposition 7.3 We write while for quantum loop "while M[g] = 1 do S". Then 
for any P G Vijiau), we have: 

1. wp.wh\\e.P = M^PMq + Ml{wp.S.{wp.while.P))Mi. 

2. tt;/p.while.P = mIpMq + Ml{wlp.S.{wlp. while. P)) Mi. 
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Proof. We only prove (2), and the proof of (1) is similar and easier. For every 
p £ T>~{TLaii)-, by Proposition 17.2( 2) we observe: 

tr[(M|JPMo + Ml{wlp.S.{wlp.^\ii\e.P))Mi)p] 
= tr{PMopM^) + tr[{wlp.S.{wlp.while.P))MipMl] 
= tr{PMopMl) + tr[{wlp.^h.i\e.P)[\S\]{MipMl)] 

+ MMipMl) - tr{[\S\]{MipMl))] 
= tr{PMopMl)+tr[P[\^\n\e\]{[\S\]{MipMl))] + [tr{[\S\]{MipMl) 

- tr([|while|]([|S|](Mi/5M|))] + [tr(MipM|) - tr([|5|](MipM|))] 
= tr[P{M^pMl + [|while|]([|5|](MipM|)))] 

+ [tr{MipMl) - tr{[\^h.i\e\]{[\S\]{MipMl))] 
= tr(P[|while|](/))) + [tr{pMlMi) - tr([|while|]([|5|](MipM|)))] 
= tr(P[|while|](/5)) + [tr{p{I - M^^Mq)) - tr([|while|]([|5|](MipM|)))] 

= tr(P[|while|](p)) + [trip) " tr{MopM^Q + [|while|]([|S|](MipM|)))] 
= tr(P[|while|](p)) + [tr{p) - tr([|while|](/9))]. 

This means that 

{M^PMo + Ml{wlp.S.{wlp.while.P))Mi}while{P}, 

and 

Q C M^PMo + Ml{wlp.S.{wlp.while.P))Mi 
provided |=par {<5}while{P}. □ 

8 Proof System for Partial Correctness 

Now we are ready to present an axiomatic system of Hoare logic for quantum pro- 
grams. The quantum Hoare logic can be divided into two proof systems, one for 
partial correctness and one for total correctness. In this section, we introduce the 
proof system qPD for partial correctness of quantum programs. It consists of the 
axioms and inference rules in Fig. 2. 

We first prove the soundness of the proof system qPD with respect to the se- 
mantics of partial correctness: provability of a correctness formula in qPD implies 
its truth in the sense of partial correctness. 

Theorem 8.1 (Soundness) The proof system qPD is sound for partial correctness 
of quantum programs; that is, for any quantum program S and quantum predicates 
P,Q £ VCHnu), we have: 

^gPD {P}S{Q} implies |=par {P}S{Q}. 
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Proof. We only need to show that the axioms and inference rules of qPD are 
valid in the sense of partial correctness. 

(Axiom Skip) It is obvious that |=par {P}skip{P}. 

(Axiom Initialization) We only prove the case of type{q) = integer, and the case 
of type{q) = Boolean is similar. For any p € 'D^('Haii), it follows from Proposi- 
tion [5312 that 

oo oo 

tr[{ |n),(0|P|0),(n|)p] = ^ tr{\n)g{0\P\0),{n\p) 

n=—oo n=— oo 

oo 

= ^ tr(P|0),(n|p|n),(0|) 

n=— oo 

oo 

= tr{P |0),(n|p|n),(0|) 

n=— oo 

= triP[\q:= 0|](p)). 

Therefore, we have: 

oo 

|=par{ Y \n)g{o\p\o)Mh-=HP}- 

n=—oo 

(Axiom Unitary Transformation) It is easy to see that 

hpar {U^PU}q := Uq{P}. 

(Rule Sequential Composition) If ^par {P}Si{Q} and |=par {Q}S2{R}, then for 
any p £ V~{Haii) we have: 

tr{Pp) < tr{Q[\SrW{p)) + Mp) - tT{[\SMp))] 

< triR[\s2ms,\]ip))) + M[\si\m - triiis^msMpm 

+ [tr{p)-tri[\S,\]ip))] 
= triR[\Si;S2\]ip)) + [tr(p) - tr([|5i; 52|](p))]. 

Therefore, |=par {P}Si] S2{R} as desired. 

(Rule Measurement) Assume that \=par {Pm}Sm{Q} for all m. Then for all 
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peV {Hall)., since ^^M^Mm = I-^.., it holds that 

m m 

= ^tr{PmM.^pMl) 

m 

< ^{triQ[\Sm\]iMmpMl)) + MM^pMl) - tr([|5„|](M„pM4))]} 

m 

<^triQ[\S^\]iM^pMl)) + i^triMmpMl) -^tri[\S^\]iM^pMl))]} 

m mm 

= tr{QY,[\Smm^pMl)) + MY^pMlM^)-tT{Y^[\SmmmpMl))]} 

m mm 

= tr((5[|measure|](/9)) + [tr{p) — tr([|measure|](p)], 

and 

Hpar {^M4PmM„Jmeasure{(5}, 

m 

where measure is an abbreviation of statement "measure M[g] : S"'. 
(Rule Loop Partial) Suppose that 

I — par 

{q}s{mIpmo + mIqmi. 

Then for all p G 'D^{7iaii), it holds that 

tr{Qp) < tT{{MlPM^ + MlQM^)[\SW{p)) + Mp) - tr{[\S\]{p))]. (7) 
Furthermore, we have: 

n 

tr[{MlPMo + MlQMi)p] < Y,tr{P{£o o {[\S\] o £i)^){p)) 

k=0 

+ tr{Q{£^o{[\S\]o£,r){p)) 

+ o{[\S\]o 8,)\p)) - tr{{[\S\] o £,f+\p))] 

k=0 

(8) 

for all n > 1. In fact, Eq. ([8]) may be proved by induction on n. The case of n = 1 
is obvious. Using Eq. ([7]), we obtain: 

triQiS, o {[\S\] o £ir){p)) < tr{{MlPMo + m|QMi)([|5|] o £ir+\p)) 

+ [tr{{8, o {[\S\] o 8^T){p)) - tr{{[\SW o £iT+\p))] 
= tr{P{£o o ([|5|] o £,r+'){p)) + tr{Q{£, o {[\S\] o £ir^^){p)) 
+ [trm o {[\S\]o£,r){p))-tr{{[\S\]o£,r+\p))]. 

(9) 
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Combining Eqs. ([8|) and Q, we assert that 

n+l 

tr[{M^oPMo + mIqMi)p] < Y,tr{P{8o o o 8if){p)) 

k=0 

+ tr{Q{£^o{[\S\]o£,r+^){p)) 



+ o {[\S\] o fi)'(p)) - o ^O'+Hp))]- 

fc=0 

Therefore, Eq. ([8]) holds in the case of n + 1 provided it is true in the case of n, and 
we complete the proof of Eq. ^ . 
Now we note that 

trm o {[\S\]o£,)>'{p)) = triM,{[\S\]o£,)''{p)Ml) 

= tri{[\S\]o£,)''{p)MlM^) 
= tri{[\S\]o£,)'ip)iI-M^,Mo)) 
= tri{[\S\] o £,)'^{p)) - tr{{£o o ([|5|] o £,fm. 

Then it follows that 

n— 1 n— 1 

Y,M£i o {[\s\] o - tr{{[\s\] o = E ° ^i)'(^)) 

A;=0 fc=0 
n— 1 n— 1 



- J][tr(^o o {[\S\] o ^O'(P)) - E ° ^i)'^'(P)) (10) 

fc=0 A;=0 
n-1 

tr(p) - tr(([|S|] o £,rip)) - tr{£, o {[\S\] o ^O'(p)). 



fc=0 

On the other hand, we have: 

tr{Q{£, o {[\S\] o £,T){p)) = tT{QNh{[\S\] o ^:i)")(p)Mt) 

<tr{Mr{[\S\]o£,r){p)Ml) 



tT{{[\S\]o£^r){p)M\M^) (11) 

tr(([|5|]ofir)(p)(/-MtMo)) 

tr(([|5|] o ^:ir)(p)) - tr((^:o o o )(p)). 
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Putting Eqs. (flOl) and ([U]) into Eq. ([8]), we obtain: 



n 

triiM^PMo + mIqMi)p] < J]tr(P(fo o {[\S\] o £^)''){p)) 

k=0 

n 

+ [trip)-^trii£ooi[\S\]oS,)'^)ip))] 

n 

= tr{P^{£oo{[\S\]o£,)^){p)) 

k=0 

n 

+ [trip)-tr{Y^{£ooi[\S\]o£,)>')ip))]. 

k=0 

Let n ^ oo. Then it follows that 

tr[{M^PMo + mIqMi)p] < tr (P[| while]] (p) + [tr{p) - tr ([| while]] (p))] 

and 

]=par {M^qPMo + M|gMi}while{P}, 

where while is an abbreviation of quantum loop "while M[g] = 1 do S"'. □ 

Now we are going to establish completeness for the proof system qPD with 
respect to the semantics of partial correctness: truth of a quantum program in the 
sense of partial correctness implies its provability in qPD. Note that the Lowner 
ordering assertions between quantum predicates in (Rule Order) are statements 
about complex numbers. So, only a completeness of qPD relative to the theory of 
the field of complex numbers may be anticipated; more precisely, we can add all 
statements that are true in the field of complex numbers into qPD in order to make 
it complete. The following theorem should be understood exactly in the sense of 
such a relative completeness. 

Theorem 8.2 (Completeness) The proof system qPD is complete for partial cor- 
rectness of quantum programs; that is, for any quantum program S and quantum 
predicates P,Q G 'P('Haii), we have: 

Npar {P}S{Q} implies h,PD {P}S{Q}. 

Proof If ]=par {P}S{Q}, then by Definition O (2) we have P □ wlp.S.Q. 
Therefore, by (Rule Order) it suffices to prove the following: 

• Claim: hgPD {wlp.S.Q} S{Q}. 

We proceed by induction on the structure of S. 

Case 1.5" = skip. Immediate from (Axiom Skip). 

Case 2. S = q := 0. Immediate from (Axiom Initialization). 
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Case 3. S = q := Uq. Immediate from (Axiom Unitary Transformation). 
Case 4. S = Si; S2- It follows from the induction hypothesis on Si and S2 that 

^qPD {wlp.Si.{wlp.S2.Q)}Si{wlp.S2-Q} 

and 

^qPD {wlp.S2.Q}S2{Q}. 

We obtain: 

^qPD {wlp.Si.{wlp.S2.Q)}Si; S2{Q} 
by (Rule Sequential Composition). Then with Proposition 17.21 (l.d) we see that 

l-gPD {wlp.Si; S2.Q}Si; S2{Q}. 

Case 5. S = measure M[q] : S. For all m, by the induction hypothesis on Sm 
we obtain: 

^qPD {wlp.Sm-Q}Sjn{Q}. 

Then applying (Rule Measurement) yields: 

hgPD {^Ml(wlp.Sm.Q)Mra}nieasure M[q] : S{Q}, 

m 

and using Proposition 17.21 (l.e) we have: 

^qPD {wlp.mea.sure M[q] : S'.i-*}measure M[q] : S{Q}. 

Case 6. S = while M[q] = 1 do S'. For simplicity, we write while for quantum 
loop "while M\q] = 1 do S"". The induction hypothesis on S asserts that 

^qPD {wlp. S.{'wlp. while. P)}S{wlp. while. P}. 

By Proposition I7.3l f2) we have: 

wlp.while.P = M^PMo + Ml{wlp.S.{wlp.while.P))Mi. 

Then by (Rule Loop Par) we obtain: 

^qPD {wlp.while.P}while{P} 

as desired. □ 



9 Proof System for Total Correctness 

The aim of this section is to present a proof system qTD for correctness of quan- 
tum program. The only difference between qTD and qPD is the inference rule for 
quantum loops. To give the rule for total correctness of quantum loops, we need a 
notion of bound function which express the number of iterations of a quantum loop 
in its computation. 
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Definition 9.1 Let P G 'P('Haii) and e > 0. ^ function t : 'D~{Tla\\) — > N is called 
a {P,e) — bound function of quantum loop "while M^q] = 1 do S"if it satisfies the 
following conditions: 

1. t{[\S\]{MipMl)) < t{p); and 

2. tr{Pp) > e implies t{[\S\]{MipMl)) < t{p) 
for all peV-{n^ii). 

Recall that a bound function t of a classical loop "while B do S od "satisfies 
the inequality t([|5'|](s)) < t{s) for any input state s. It is interesting to compare it 
with conditions (1) and (2) of the above definition, and we see that the latter are two 
inequalities between t{\\S\]{MipM\)) and t{p) but not between i([|5'|](p)) and t{p). 
This is because in the implementation of the quantum loop "while M[q] = 1 do 5"' , 
we need to perform the yes-no measurement M on p when checking the loop guard 
"M[g] = 1", and the state of quantum variables will become MipM\ from p whence 
the measurement outcome "yes" is observed. 

The following lemma gives a characterization of the existence of bound function 
of a quantum loop in terms of the limit of the state of quantum variables when the 
number of iterations of the loop goes to infinity. It provides a key step for the proof 
of soundness and completeness of the proof system qTD. 

Lemma 9.1 Let P G V{7ia\\). Then the following two statements are equivalent: 

1. for any e > 0, there exists a {P, e) — bound function of quantum loop 'Svhile M[g] = 
1 do 5"; 

2. lim„_oo tr{P{[\S\] o Sirip)) = for all p G p-(Wall). 
Proof. (1 =^ 2) We prove this by refutation. If 

hm tr{P{[\S\]o£,r{p))^0, 

n— >oo 

then there exist eo > and strictly increasing sequence {n^} of nonnegative integers 
such that 

tr{P{[\S\]o£,r''ip))>eo 

for all A; > 0. Thus, we have a (P, eo)— bound function of loop while M\q] = 1 do S. 
For each /c > 0, we set 

Pk = {[\s\]o£,r^{p). 

Then it holds that tr{Ppk) > eo, and by conditions 1 and 2 in Definition 19.11 we 
obtain: 

ttM>teA\S\]{MiPkMl)) 
= t,MS\]o£i){pk)) 

>t,M\sWo£ir+--^'{Pk)) 

= teo{Pk+l)- 
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Consequently, we have an infinitely descending chain {teoipk)} in the set of non- 
negative integers. This is a contradiction because N is a well-founded set. 
(2 1) For each p G p-(Waii), if 

lim tr{Pi[\S\]o£^r{p))=0, 

n— >oo 

then for any e > 0, there exists N eN such that 

tr{P{[\S\]o£,y\p))<e 

for all n > A'^. We define: 

te{p) = mm{N e N : tr{P{[\S\] o f i)"(p)) < e for all n > AT}. 

Now it suffices to show that is a (P,e)— bound function of loop "while M[q] = 
1 do S" . To this end. we consider the following two cases: 

Case 1. tr{Pp) > e. Suppose that te{p) = N. Then tr{Pp) > e implies N > 1. 
By the definition of tg, we assert that 

tr{P{[\S\]oS,np))<e 

for all n>N. Thus, for all n > AT - 1 > 0, 

tr{P{[\S\]o£,r{[\S\]{MlpM,))) = tr{P{[\S\]o£,r+\p)) < e. 

Therefore, 

t,{[\S\]{MlpMi)) <N-1<N = Up). 

Case 2. tr{Pp) < e. Again, suppose that te{p) = N. Now we have the following 
two subcases: 

Subcase 2.1. N = 0. Then for all n > 0, 

tr{P{[\S\]o£,r{p))<e. 

It is easy to see that te{[\S\]{MipMl)) = = teip). 
Subcase 2.2. n> 1. We can derive that 

Up)>t,{[\S\]{M,pMl)) 

in the way of Case 1. □ 

Now we are ready to present the proof system qTD for total correctness of quan- 
tum programs. It consists of the axioms (Axiom Skip), (Axiom Initialization) and 
(Axiom Unitary Transformation) and inference rules (Rule Sequential Composition), 
(Rule Measurement) and (Rule Order) in Fig.2 as well as inference rule (Rule Loop 
Total) in Fig.3. 

The remainder of this section will be devoted to establish soundness and com- 
pleteness of qTD: provability of a correctness formula in qTD is equivalent to its 
truth in the sense of total correctness. 
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Theorem 9.1 (Soundness) The proof system TD is sound for total correctness of 
quantum programs; that is, for any quantum program S and quantum predicates 
P,Q & V{T-Ls,\\), we have: 

^qTD {P}S{Q} implies Hot {P}S{Q}. 

Proof. It suffices to show that the axioms and inference rules of TD are valid in 
the sense of total correctness. 

The proof for soundness of (Axiom Skip), (Axiom Initialization) and (Axiom 
Unitary Transformation) is similar to the case of partial correctness. 

(Rule Sequential Composition) Suppose that |=tot {P}Si{Q} and ^tot {Q}S2{R}- 
Then for any p G ^?^('Haii), with Proposition 15.11 4 we obtain: 

tr{Pp)<tr{Q[\Si\]{p)) 

<tr{R[\SMSiW{p))) 
= tr{P[\Sv,S2\]{p)). 

Therefore, hot {P}Si; S2{R}. 

(Rule Measurement) Suppose that ^tot {Pm}Sm{Q} for all m. Then for any 
p G P~('Haii)) it holds that 

tr{PmMmpMl) < tr{Q[\S„,\]{MmpMl)) 

because {Pm}Sm{Q} for all m. Therefore, we have: 

tr{Y^MlPmM^p) = Y,tr{PmMmpMl) 

m m 

<^triQ[\Sm\]{M^pMl)) 

m 

= tr{QY,[\Sm\]{M^pMl)) 

m 

= ir(Q[| measure M[q] : S\]ip)), 

and 

Kot {^Mt^PM^jmeasure M[q] : S{Q}. 

m 

(Rule Loop Total) If 

Hot {Q}s{mIpmq + mIqmi], 

then for any p G V~{TLgx\)^ we have: 

tr{Qp) < tr{{MlPMo + mIqMi)[\S\]^M)- (12) 
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We first prove the following inequality: 

tr[{MlPMo + MlQMi)p] 

(13) 

< J2 HP[£o o {[\S\] o £,)f{p)) + tr{Q[£^ o {[\S\] o £,y^]{p)) ^ ^ 

by induction on n. It holds that 

tr[{M^PMo + mIqMi)p] = tr{PMopM^) + tr{QMipMl) 

= tr{P£o{p))+tr{Q£i{p)). 

So, Eq. ()13p is correct for the base case of n = 0. Assume Eq. (llSp is correct for the 
case of n = m. Then applying Eq. (jl2p . we obtain: 

triiM^PMo + mIqMi)p] = tr{P£oip)) + tr{QMipMl) 

m 

< J2 triP[£o o i[\S\] o £,)fip)) + tr{Q[£, o ([|5|] o £,r]ip)) 

k=0 
m 

< J2 HP[£o o i[\S\] o £,)f{p)) + tr((MtpMo + MlQM,)[\S\m ° ([l^l] ° ^OHlp))) 



k=0 
m 

A;=0 



Y,tr{P[£o o {[\S\]o£,)fip))+tr{PMo[\S\m ° {[\S\] o £,r]{p))A4 

+trmh[\s\m ° ([|5|] o£:in(p))Mt^ 



m+l 



k=0 

Therefore, Eq. (jlSp also holds for the case of n = M + 1. Now, since for any e > 0, 
there exists M^QMi, e— bound function of quantum loop "while M[q] = 1 do 5", 
by Lemma |9. II we have: 

hm tr{Q[£i o {[\S\] o £^)^{p)) = lim tr{QMi{[\S\] o £^r{p)Ml) 

n— ►oo n^oo 

= lim tr{MlQMi{[\S\]o£^)''{p)) = 0. 

n— >oo 

Consequently, it holds that 



tr[{M^oPMo + mIqMi)p] < lim Vtr(P[£:o o {[\S\] o £^)]-{p)) 

k=0 

+ hm tr(Q[£:io([|5|]o£:ir](p)) 

oo 

= ^tr(P[^:oo([|5|]o£:i)r(p)) 

n=0 

oo 

= tr{Pj2[£oo{[\S\]o£,r]{p)) 

n=0 

= tr(P[|while M[g] = 1 do S\]{p)). □ 
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Theorem 9.2 (Completeness) The proof system TD is complete for total correct- 
ness of quantum programs; that is, for any quantum program S and quantum predi- 
cates P,Q £ Vijiaw), we have: 

hot {P}S{Q} implies hgTD {P}S{Q}. 

Proof. Similar to the case of partial correctness, it suffices to prove the following: 

• Claim: hgTD {wlp.S.Q}S{Q} for any quantum program S and quantum 
predicate P G V{7ian) 

because by Definition 17.11 (1) we have P Q wp.S.Q when \=tot {P}S{Q}. The above 
claim can be done by induction on the structure of S. We only consider the case 
oi S = while M[g] = 1 do S', and the other cases are similar to the proof of 
Theorem 18.21 We write while for quantum loop "while M[g] = 1 do S'". It follows 
from Proposition 17.3( 1) that 

wp.while.Q = M^QMq + {wp.S.{wp. while. Q)) Mi. 

So, our aim is to derive that 

hgTD {mIqMo + Ml{wp. S.{wp. while. Q))Mi]wh.i\e{Q]. 

By the induction hypothesis on S' we get: 

^qTD {wp.S' . {wp.while.Q)} S {wp.while.Q}. 

Then by (Rule Loop Total) it suffices to show that for any e > 0, there exists 
a {M\{wp.S' . {wp.S.Q))Mi,e)—hoxnid function of quantum loop while. Applying 
Lemma l9.lt we only need to prove: 

lim tr{Ml{wp.S'.{wp.while.Q))Mi{[\S'\] o fi)"(p)) = 0. (14) 

n— >oo 

First, by Propositions 17. ll (2) and 15.11 (6) we observe: 

tr{Ml{wp.S'.{wp.while.Q))Mi{[\S'\] o EiY{p)) 

= tr{wp.S' .{wp.while.Q)Mi{[\S'\]o £iY{p)Ml) 

= tr{wp.while.Q[\S'W{Mi{[\S'\]oSiT{p)Ml)) 

= tr{wp.while.Q{[\S'\] o £iT+^{p)) (15) 

= tr(Q[|while|]([|5'|]ofO"+^(p)) 

oo 

= Yl tr{Q[8,o{[\S'\]o£if]{p)). 

k=n+l 

Second, we consider the following infinite series of nonnegative real numbers: 

oo oo 

Ytr{Q[£o o {[\S'\] o Si^p)) = tr{QY,l£o o {[\S'\] o Si^p)). (16) 

71=0 n=0 
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Since Q C /t^^,,, it follows from Propositions 15.11 (6) and 15.21 that 

oo 

ir(Q 5][fo o of i)'](p)) = tr(Q[|while|](p)) 

n=0 

< tr([|while|](p)) < tr{p) < 1. 

Therefore, the infinite series Eq. (jl6p converges. Note that Eq. (|15p is the sum of the 
remaining terms of the infinite series Eq. (|16p after the nth term. Then convergence 
of the infinite series Eq. (jl6p implies Eq. (jl4p . and we complete the proof. □ 

It should be pointed out that the above theorem is merely a relative completeness 
of qTD with respect to the theory of the fields of complex numbers because except 
that (Rule Order) is employed in qTD, the existence of bound functions in (Rule 
Loop Total) is also a statement about complex numbers. 

10 Conclusion 

Based on D'Hondt and Panangaden's idea of representing quantum predicates by 
Hermitian operators and Selinger's idea of modeling quantum programs by super- 
operators, a full-fledged Hoare logic is developed for deterministic quantum pro- 
grams, and its completeness relative to the theory of the field of complex numbers 
is proved in this paper. 

An interesting problem for further studies is to find reasonable extensions of the 
quantum Hoare logic presented in this paper for bigger classes of quantum programs, 
including nondeterministic quantum programs [25j, parallel and distributed quan- 
tum programs. Hopefully, they will serve as a logical foundation of various effective 
techniques for verification of these bigger classes of quantum programs. 
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Appendix: Proof of Proposition 15.31 

(1) We proceed by induction on the structure of S. 
Case 1. S = skip. Obvious. 

Case 2. S = q := 0. We only consider the case of type{q) = integer, and the 
case of type{q) = Boolean is similar. It holds that 

oo 

tr,ar(S){[\S\]{p)) = Yl g{n'\0)g{n\p\n)g{0\n'), 

n,n'=—oo 
oo 

= q{n\p\n)q 

n= — oo 

Case 3. S = q := Uq. If {I'i/'j)} is an orthonormal basis of Tig, then {U^tpi}} is 
also an orthonormal basis of TCg. Consequently, 

trVar{S)i[\S\]ip)) = Y('^i\^P^^\'^i) = t^Var{S)ip)- 
i 

Case 4. S = Si; 82- By the induction hypothesis on Si and 5*2, we have: 

trvar{S)i[\S\]{p)) = tr^ar(S,)Uvar{S2)i[\S2\]i[\Sl\]ip))) 

var(S2) 

var(S2) 

var(S\ ) 
= tryar{S2)(J^'^var{Si){p)) 
= tr^ar{S){p)- 

Case 5. = measure M\q] : S. By the induction hypothesis on Sm for all 
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outcome m of measurement M, we obtain: 

tr,ar(S)i[\S\]{p)) = ^tr,^riS)i[\Sm\]{MrnpMl)) 
m 

—var(Sm) v^'var^Sm) 

{[\S^W{M^pMl))) 

m 

= ^ tr^ar{S)-var{S^)i'trvar{Sra)i^rnPMl^)) 
m 

m 

= ^tr^ar{S)-{q}itrqiMmpMl)) 
m 

= '^tryar{S)-{q}{trq{Ml^MmP)) 
m 

= tr^ar{S)-{q}itrg{C^MlM^)p)) 

m 

= tr^mis)-{q}(.trq{p)) 
= tr^ar(S) (P) 

because Ylm ^liMm = lUg- 

Case 6. S = while M[g] = 1 do S'. For simplicity, we write while for quantum 
loop "while M[q] = 1 do S"". First, we have: 

ir.a.(s)([|(while)0|](p)) = 0„„„, 

*W(s)([l(while)"|](p)) = tr^ar{s){p) (17) 
for all n > 1. This can be proved by induction on n. In fact, 

(while) ''^-'^ = measure M[q] : 5 

where 5 = So,Si, Sq = skip, and = 5'; (while)'^. Thus, by Cases 1, 4 and 5, 
we can derive Eq. (117p for n = k + 1 immediately from the induction hypothesis for 
n = k. Now, it follows from continuity of trace that 

oo 

tr.ar(S)i[\S\]{p)) = tr,„,(5)( V [|(while)"|](p)) 

n=0 

oo 

= V*W(5)([l(while)"|](p)) 

n=0 
= ir^ariS)(.P)- 

(2) The trick is to prove the following slightly stronger conclusion: 

• Claim: For any var{S) C X C Var, trx-var{s){Pi) = trx-var{s){P2) implies 
trx 

—var{S) —var{S) 
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We also proceed by induction on the structure of S. 
Case 1.5* = skip. Obvious. 

Case 2. S = q := 0. We only consider the case of type{q) = integer, the case of 
type(q) = Boolean is similar. First, let {IV'i)} be an orthonormal basis of Tlx-{q}, 
then we have: 

oo 

trX-var{S)i[\S\]ip)) = trx-{g}[ ® Iny^r-M)pi\^)li^\ ® iHy^r-M)] 

n=—oo 

oo 

i n=—oo 
oo 

n=—oo i 
oo 

= \^)<l{'^\'^^X-var{S){p)\n)q{% 
n=—oo 

Thus, it is easy to see that (2) holds in this case. 

Case 3. S = q := Uq. Assume that {IV'i)} is an orthonormal basis of Hx-{q}- 
Then it holds that 

trx —var{S) 

= IZ(^'W(v--x)um ^{H)iU^ lHy,^_^^y)p{U^ ® -^•H^ar-m)(^'«(^--x)um ^ IV'^)) 

i 

i 

= {U ® lHy,,_{-^-^)trx-var(S){p){U'^ ® lHy,,_{-^-^) 

because iV'i) G 'Hx-{q}i U G C(Hq), and {X — {q}) n {g} = 0. Now it is easy to see 
that (2) holds in this case. 

Case 4. S = Sr, 82. If var{Si) U var{S2) = var{S) C X, then there are Y,Z C 
Var such that var{S\) C Y , var{S2) C Z and 

Y - var{Si) =X- var{S) = Z- var{S2). 

Thus, we have: 

ifY-var{Si){Pl) = tfX~var{S){pl) 
= tfx-var{S){P2) 
= trY-var{Si)ip2)- 
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By the induction hypothesis on ^i, we obtain: 

trz-var{S2)i[\Sl\]iPl)) = trY-var(Si){[\Sl\]{pl)) 
= trY-var(Si)i[\Sl\]{p2)) 
= trz-var(S2)i[\Sl\]{p2))- 

Furthermore, by the induction hypothesis on 5*2, we obtain: 

trx-var{S){[\S\]ipi)) = trz-.var{S2)i[\S2\]i[\Sl\]ipi))) 

= irz-w(&)([|^2|]([|5i|](p2))) 

= tr^X-var{S){[\S\]ip2))- 

Case 5. S = measure M[q] : S. First, let {iV'j)} be an orthonormal basis of 
Ti.x-var{S)- Then for any outcome m of measurement M, we have: 

i 

Var-{X-var{S)) 

i 

= Mmtrx-var{S){p)M}n 

because G Ti-x-variS): € jO,{Hq) and {X — var{S)) PI {q} = 0. Consequently, 
it follows from trx-var(S){Pl) = trx-var{S){P2) that 

trx (MmpiMl) = trx {MmP2Ml). 

Note that we can write X — var{S) = Y — var{Sm) for some Y D var{Sm)- Then it 
holds that 

{MmP2Ml). 

By the induction hypothesis on Sm, we obtain: 

trx-var{S){[\Sm\]{MmPlMl)) = trY-^ar{S^){[\Srn\]{MmPlMl)) 

= trY^^ar{Sm)i[\Sm\]{M^p2Ml)) 
= trx-var{S){[\Sm\]iMmP2Ml)). 
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Therefore, it follows that 

trx —var{S) 

m 

—var{S) 

m 

= Y,t^X-var{S){[\Sm\]{M^P2Ml)) 
m 

= trx-var{S) ^[\Sm\]{MmP2Ml) 

m 

= trx-var{S)i[\S\]ip2))- 

Case 6. S = while M[g] = 1 do S'. Assume that trx-var{S){Pi) = 'tfx-var{S){P2) 
Using Cases 1, 4 and 5, we can show that 

irx-.ar(5)([l(while)-|](pi)) = trx-.aK5)([l(while)-|](p2)) 
for all n > by induction on n. Therefore, we obtain: 



([|while|](pi)) =trx (\/[|(while)"|](pi)) 

n=0 

oo 

= V*^^— K5)([l(while)«|](pi)) 

n=0 

oo 

= V*^^— KS)([l(whiIe)«|](p2)) 

n=0 

oo 

= irx-.„KS)(V[l(whiler|](p2)) 



n=0 

i''x-mr(5)([|while|](p2)) 



by continuity of trace. 
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(skip,p)^(^,p) 



{Initialization) 



{q := 0,p)^{E,pI) 
where 

p^ = |o),(oHo),(o| + |o),(iHi),(o| 

if type{q) = Boolean, and 

oo 
n=—oo 

if type{q) = integer. 
{U nitary Transformation) 



{Sequential Composition) 



{q:=Uq,p)^{E,UpW) 
{S,,p)^{S[,p') 



{Si;S2,p) {S[;S2,p) 
where we make the convention that E; S2 = 82- 
{Measurement) 



(measure M[q] :S,p)^ {S^^M^pMl) 

for each outcome m of measurement M = {M^} 

{Loop 0) 1- 

(while M[g] = 1 do ^ {E,MopM^) 

{Loop 1) 



(while M[q] = ldoS,p) ^ (S; while M[q] = 1 do S,MipMl) 
Figure 1: Transitional Semantics of Quantum Programs 
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{Axiom Skip) {P}Skip{P} 
{Axiom Initialization) If type{q) = Boolean, then 

{|0),(0|P|0),(0| + |l),(0|P|0),(l|}g := 0{P} 
and if type{q) = integer, then 

oo 

{ J2 |n),(0|P|0),(n|}g:=0{P} 

n=— oo 

{Axiom Unitary Transformation) {U^PU}q := Uq{P} 

{P}Si{Q} {Q}S2{R} 



{Rule Sequential Composition 
{Rule Measurement) 



{P}Si;S2{R} 
{Pm}Sm{Q} for all m 



{Rule Loop Partial) 



{Rule Order) 



{Rule Loop Total) 



{J2mMlPmMm}mesLSure M[q] : S{Q} 

{Q}S{mIpMo + mIqMi} 

{M^PMq + M^QMilwhile M[q] = 1 do S{P} 

P\ZP' {P'}S{Q'} Q'\ZQ 
{P}S{Q} 

Figure 2: Proof System qPD of Partial Correctness 



{q}s{mIpMo + mIqm^} 

for any e > 0, is a {M\QMi, e) — bound function 
of loop while M[g] = 1 do 5 



{mIpMq + M^QMilwhile M[g] = 1 do S{P} 
Figure 3: Proof System qTD of Total Correctness 
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